Bug 189031
| Summary: | Function mlx4_ib_query_device() does not set error codes on some failures | ||
|---|---|---|---|
| Product: | Drivers | Reporter: | bianpan (bianpan2010) |
| Component: | Infiniband/RDMA | Assignee: | drivers_infiniband-rdma |
| Status: | RESOLVED CODE_FIX | ||
| Severity: | normal | ||
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | linux-4.9-rc6 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: | The patch fixes the bug | ||
Created attachment 256451 [details]
The patch fixes the bug
The patch has been merged into the latest version of the Linux kernel. So I will close the bug.
|
Functions kzalloc() and kmalloc() return NULL pointers if there is no enough memory. They are called in the function mlx4_ib_query_device() defined in file drivers/infiniband/hw/mlx4/main.c. If they return NULL pointers (see line 458), function mlx4_ib_query_device() returns variable err. Because variable err is checked at line 444, the value of err may be 0 when kzalloc() and kmalloc() are called. As a result, 0 (indicates success) may be returned even on failures. Though these errors may occur rarely, I think it is better to set correct error code (e.g. -ENOMEM) when kzalloc() and kmalloc() returns NULL pointers. Codes related to this bug are summarised as follows. mlx4_ib_query_device @@ drivers/infiniband/hw/mlx4/main.c 426 static int mlx4_ib_query_device(struct ib_device *ibdev, 427 struct ib_device_attr *props, 428 struct ib_udata *uhw) 429 { 430 struct mlx4_ib_dev *dev = to_mdev(ibdev); 431 struct ib_smp *in_mad = NULL; 432 struct ib_smp *out_mad = NULL; 433 int err = -ENOMEM; ... 439 if (uhw->inlen) { 440 if (uhw->inlen < sizeof(cmd)) 441 return -EINVAL; 442 443 err = ib_copy_from_udata(&cmd, uhw, sizeof(cmd)); 444 if (err) 445 return err; 446 447 if (cmd.comp_mask) 448 return -EINVAL; 449 450 if (cmd.reserved) 451 return -EINVAL; 452 } 453 454 resp.response_length = offsetof(typeof(resp), response_length) + 455 sizeof(resp.response_length); 456 in_mad = kzalloc(sizeof *in_mad, GFP_KERNEL); 457 out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL); 458 if (!in_mad || !out_mad) // The value of err may be 0. Insert "err = -ENOMEM;" ? 459 goto out; ... 567 out: 568 kfree(in_mad); 569 kfree(out_mad); 570 571 return err; 572 } Thanks very much!